New Password Stealer Bypasses 2FA—Chrome, Edge And Firefox Targeted

A new security threat for users of the world’s most popular web browsers, Google Chrome, Microsoft Edge and Mozilla Firefox, has been confirmed by Varonis Threat Labs researchers. And this one’s a doozy: a password stealer, a session cookie compromiser to enable two-factor authentication bypass, and a payment card data grabber all rolled into one. Here’s what you need to know Storm, the latest infostealer platform now available for cybercriminals to rent .

MORE FROM FORBES Google Issues Zero-Day Attack Alert For 3.5 Billion Chrome Users By Davey Winder

No sooner have more than three billion Chrome users been given a security wake-up call, as Google confirmed a new zero-day exploit out in the wild, another billion web browser users have been put on alert. A new report from the Varonis Threat Labs has warned users of Google Chrome, Microsoft Edge and Mozilla Firefox of a new infostealer service, already being rented out to cybercriminals, that can remotely decrypt credentials in a way that allows the attackers to stealthily evade security measures, according to senior Varonis security researcher, and author of the report, Daniel Kelley.

“Meet Storm,” Kelley said , “a new infostealer that tiptoes around endpoint security tools, remotely decrypts browser credentials, and lets operators restore hijacked sessions.” And if all of that sounds worrying, it should do.

This low-cost cybercrime toolkit can be rented for as little as $1000 a month, and, yes, that isn’t a lot of money for an attacker who is looking at something that can harvest browser credentials, session cookies and crypto wallets, and then proceed to very quietly send the whole lot back to their server to be decrypted. This, Kelley warned, represents a shift in the evolution of credential theft. And that matters because, whereas the attacker used to decrypt credentials on the victim device using SQLite libraries that accessed the credential store directly, for those of a technical bent, that got difficult to pull off as security tools learned to recognize such local browser database access as a huge red flag. The difficulty knob was turned to 11 when Google introduced App-Bound Encryption in 2024, with the launch of Chrome 127, which binds encryption keys to Chrome itself. Even when attackers started abusing the Chrome debugging protocol or injecting directly into Chrome, security tools were still able to detect traces and act.

MORE FROM FORBES WhatsApp Attacks—Microsoft Shares Warning 3 Billion Users Must Heed By Davey Winder

Storm has followed other infostealer developers by moving the encrypted files to their own servers instead, but has also taken the evolutionary process to another level, Kelley warned: “Storm takes this approach further by handling both Chromium and Gecko-based browsers server-side.”

And that’s not all, once the browser data, credentials and session cookies have been decrypted, Storm dumps the lot into the cybercriminal operator panel. This is where it gets interesting, as automation enters the exploit stage, according to the Varonis report: “Feed in a Google Refresh Token and a geographically matched SOCKS5 proxy, and the panel silently restores the victim's authenticated session.” Yikes. At an enterprise level, this means that a single compromised browser can give an attacker “access to SaaS platforms, internal tools, and cloud environment,” Kelley said. As for the consumer, it’s not any better, as the data that is stolen gives the attacker everything needed to gain access to your accounts without having to go through the 2FA process; the already hijacked session is just restored remotely, leaving you open to everything that comes with it: account takeover, fraud and initial access for more targeted intrusions.

I have reached out to Google, Microsoft and Mozilla for a statement and advice to users. In the meantime, I would suggest that all browser users take the usual precautions against social engineering, only download applications from trusted sources, and ensure that they don’t reuse the same password across accounts and services. 2FA is still recommended, as is the use of a passkey where applicable.

MORE FROM FORBES Google Confirms High-Risk Update For 3.5 Billion Chrome Users By Davey Winder

This article was originally published on Forbes.com